On Wednesday, Bitcoin exchange and payment processor Coinbase proudly announced that it has been holding insurance against theft or loss of its coins for almost a year. In the announcement, Coinbase states:
“Coinbase is insured against theft and hacking in an amount that exceeds the average value of bitcoin we hold in online storage at any given time. The insurance covers losses due to breaches in physical or cyber security, accidental loss, and employee theft. It doesn’t cover bitcoin lost or stolen as a result of an individual user’s negligence to maintain secure control over their login credentials.”
In the same post, Coinbase compares its insurance to the insurance of its (unnamed) competitors as it writes:
“Some bitcoin wallets may claim to be “fully insured” while not working with accredited carriers or outright self-insuring. Others may be able to claim “fully insured” at the moment because their number of bitcoin stored are so low that a small insurance policy happens to cover everything until they grow.”
Limited Liability
This corresponds to the findings by Digiconomist when cryptocurrency insurance was examined in March this year. Any sane insurance company is not likely to take full liability for an extremely volatile asset in exchange for a fixed fee. In the case of the defaulted exchange Mt.Gox, over 600,000 Bitcoins went missing. Should this occur after the price suddenly rises to $10,000 per coin (not unrealistic according to many), it would result in a claim worth $6 billion on the insurer. Even for the largest insurers that is a very big amount. This is why the insurer will either limit its liability to limit this risk, or charge a fee that not a single cryptocurrency exchange can currently pay.
Coinbase’s Insurance Policy
The caveat to Coinbase’s insurance is that its insurer’s liability must therefore be limited as well. Coinbase seems to confirm this on its security page, stating: “Funds not stored offline are covered by insurance.” This is not exactly full coverage of all of Coinbase’s reserves as might be expected. In fact, Coinbase keeps 97 percent of customer funds offline in cold storage so the insurance applies to just the three percent in the hot wallet. Another reason why this makes sense is that funds stored offline are more difficult to monitor, and have to be audited to verify they even exist.
Upper Bound
With the help of some statistics, it is even possible to make an educated guess on the upper bound of Coinbase’s insurance. In February 2013 Coinbase was processing $1 million in transactions per month, while in May this had increased to $15 million per month. During January, there were roughly 40,000 transactions per day at a rate of $17 per Bitcoin. At $1 million in transaction for the full month, the average transaction size was 0.05 Bitcoins or $0.85. In May, the price has increased to $126 per Bitcoin, and Coinbase processed about 50,000 transactions per day. This implies 0.08 Bitcoin per transaction or $10.08.
As the rate has gone up even further to $609 in July this year, while the number of transactions has increased to 70,000 per day, the current monthly volume should be around $100 million assuming the number of Bitcoins per transaction has not changed much. Any insurance is not likely to exceed the entire monthly volume on the exchange. $100 million is equal to 164,000 Bitcoins on the July average rate. If Coinbase holds three percent in a hot wallet, it could have over 5 million Bitcoins in total and still have its hot wallet fully insured. This is another indicator that the insured amount is a lot less than $100 million, more likely in the direction of $25 million. The exact amount does not matter that much, as it falls short of the worst case scenario of a potential $6 billion loss or even “just” $400 million in a Mt.Gox scenario.
Conclusion
Of course, cold storage funds are typically not vulnerable so fully insuring all reserves should not be required. But still, things went wrong at Mt.Gox and in such a scenario Coinbase’s insurance probably will not save it either. Insurance is a nice addition, but is not the ultimate solution to theft and loss of coins. Users should therefore not over-value this.
